Doctor Appointment System CVE-2025-50493

Exploitation targets the /doctor/change-password.php session flow and requires the attacker to first possess a valid doctor session token - the vulnerability is the failure to invalidate that token after a password change, so the credential reset that a victim performs to lock an attacker out does NOT terminate the attacker's session. Limiting factors: the attacker must acquire a session identifier through a separate means (shared machine, sniffing on non-TLS deployments, or another injection flaw), and the impact is scoped to the specific doctor account whose session was captured. This is confined to PHPGurukul Doctor Appointment Management System v1.0.0; despite the CVSS PR:N labeling, real exploitation is not a zero-prerequisite remote takeover because a pre-existing session must be held.

The signals conflict and warrant scrutiny. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, score 7.5) is internally inconsistent with the described impact: session hijacking of a doctor account is a confidentiality/integrity compromise, yet the vector encodes C:N/I:N and A:H (availability-only), which does not match session-hijacking semantics - this appears to be a mis-scored vector and should be verified with the source. EPSS is low (0.41%, 33rd percentile) and the CVE is not in CISA KEV, so there is no evidence of widespread or active exploitation. A PoC exists, raising the practical likelihood of opportunistic use, but exploitation realistically requires the attacker to first obtain a valid session token, which is a meaningful precondition the AC:L rating understates. Net: this is a legitimate defect but a low-to-moderate real-world priority, driven more by product niche-ness than by exploitability.

An attacker obtains a doctor's active session identifier (for example via a shared/public workstation, network sniffing on a non-HTTPS deployment, or an XSS leak) and continues using it after the legitimate doctor changes their password, since the old session is never invalidated. Because a PoC is publicly available, an attacker can reproduce the flow directly; the retained session grants ongoing access to patient appointment data and account functions.